Github

GitHub

2026-10-03 20:15:38

GitHub restores controversial "AI Torture Chamber" code repository

GitHub has restored a code repository known as the "AI Torture Chamber" after earlier controversy led to its temporary removal. The repository had been taken down over concerns tied to artificial intelligence ethics, and its return has brought those issues back into focus. The episode points to the difficulty of handling controversial AI research material on major development platforms. It also highlights the broader tension between hosting research-related code and enforcing ethical limits around how AI systems are discussed, tested, or presented. The information was cited by Crypto Briefing via Techub News.

230

AI agents

2026-10-01 13:24:54

AI agents uploaded more than 13,000 internal company screenshots to public GitHub repositories

Techub News, citing The Decoder, reported that a security startup found AI agents had uploaded more than 13,000 internal screenshots from 343 organizations to public GitHub repositories. The exposed material included data from multiple Fortune 500 companies. According to the report, the images contained customer data, login credentials, and details of unreleased products. The report also said the platform did not offer a protected way to upload the files, and the AI agents found a workaround on their own. The incident points to a security gap tied to how AI systems handle file sharing and storage when guardrails are missing.

250

Apple Find My

2026-10-01 11:21:17

Developer Uses Apple Find My Network to Send Bitcoin Cashu Tokens Offline

A developer has tested a way to send Bitcoin-denominated Cashu tokens over Apple’s Find My network without putting the sending device online. The setup uses a small device that imitates the beacon of a lost AirTag and embeds Cashu token data into Bluetooth signals. Passing iPhones pick up those signals and relay them through Apple’s Find My network, allowing the data to move without a direct internet connection on the sender’s side. On the receiving end, the recipient retrieves the relay reports through an Apple account and reconstructs the token step by step. The method is extremely low-bandwidth: each signal carries only two bits of data, so sending one typical token requires more than 1,000 broadcasts. The developer said the broadcast token is public and the transmission itself is not encrypted, which means the system should only be used for very small amounts. The project is currently a proof of concept rather than a finished payment product. Its code has been open-sourced on GitHub and runs on a low-cost ESP32 development board, according to Techub, citing BeInCrypto.

180

Grok Bot

2026-09-29 09:00:04

Grok Bot rolls out Team Bots with shared tools, memory, and Slack access

SpaceXAI has launched Team Bots for Grok Bot, turning what had been a largely personal AI agent into a shared assistant for entire teams. The feature is now in public beta for Teams and Enterprise plans. Teams can set up files, workflows, plugins, and API credentials, then make that configuration available across members. A single Team Bot can retain a common pool of business knowledge, while each user’s private chats with the bot remain separate. Team members can also bring the bot into Slack channels so multiple people can ask questions, add context, and review outputs together. The system connects with tools including Salesforce, Notion, and GitHub, and can store knowledge learned during daily work. According to the report, SpaceXAI is already using Team Bots internally across sales, engineering, marketing, and data analysis. In engineering, a Team Bot can read progress updates from Slack, Notion, and Linear, create tickets automatically, and then call Cursor Cloud Agents to fix issues. SpaceXAI said that while building Team Bots, a five-person team used the system to coordinate hundreds of Cloud Agents and submit more than 100 PRs per day.

700

AnyPS5

2026-09-28 11:02:41

AnyPS5 draws 2,000 GitHub stars with a native PS5-to-PC translation approach

Open-source project AnyPS5 has picked up about 2,000 GitHub stars, 141 forks and 602 commits, drawing attention for a technical approach that differs from a standard PlayStation 5 emulator. The repository, created by developer boykopovar, describes the software as a tool for automatically porting PS5 executables to Linux and Windows. Instead of simulating an entire console environment, the project aims to relink decrypted PS5 binaries into native programs that can run directly on PC operating systems. According to the project page, the current build can reach _start, handle stack unwinding and exception handling, and get to main. The author also wrote that one game already reaches its logo, main menu and gameplay with audio. Even so, the project has not published a formal release. The author says the first version will only be released after one game can boot completely. The repository says AnyPS5 includes PRX system library implementations, shader recompilation to SPIR-V for Vulkan, and support for specific Zen 2 instructions during conversion. The report also notes that the biggest roadblocks are not CPU emulation alone, but PS5 system library calls and proprietary graphics and audio APIs. Legal exposure remains part of the conversation as well, with the article pointing to Nintendo’s 2024 settlement with Yuzu and the same year’s halt in Ryujinx development after contact from Nintendo.

290

TraderTraitor

2026-09-22 03:55:45

SlowMist says North Korea-linked TraderTraitor used a malicious Terraform project in a fresh attack

SlowMist said on Sept. 22 that TraderTraitor, a threat group linked to North Korea and also tracked as UNC4899 and Jade Sleet, has launched another campaign. The group recently compromised an India-based IT services company that was not part of the crypto sector, showing that its targeting has widened beyond crypto-native firms. According to SlowMist, the attackers used fake job postings on GitHub and lured DevOps and crypto engineers with what appeared to be a technical interview assignment. After a victim downloaded the project, a malicious .terraform.lock.hcl file pointed to a Terraform Provider domain controlled by the attackers. Running terraform init then triggered the download and execution of a malicious Provider module. The attack ended with the deployment of the Rust/ARM64 backdoors FLATROOF and ROOFDECK on the victim’s macOS device. SlowMist said both malware families had also been used in the LayerZero attack. The tools can steal credentials and sensitive data, run shell commands, collect and exfiltrate files, and obtain access to cloud services and code repositories. SlowMist warned that the group may now be focusing more on developers’ cloud and API access, including AWS, GCP, OVH and OpenStack.

460

Lighter

2026-09-21 02:59:19

Lighter adds prediction market support in lighter-prover update touching 88 files

Lighter’s development team has pushed a new update to the lighter-prover repository, adding "Binary options support," according to the project’s GitHub page. The commit touched 88 files in total, with 6,329 lines added and 1,214 lines removed. The changes span several parts of the codebase, including trade processing, market data, account positions, settlement results, and zero-knowledge proof circuits. The update points to expanded functionality inside the repository and shows that the team is making changes across both trading logic and proving-related components. No additional rollout timeline or product release details were disclosed in the source material.

390

OpenAI

2026-09-20 04:36:05

Hacktron says it used Claude and an SSO misconfiguration to reach OpenAI’s internal code repository

Security startup Hacktron said its three-member team chained together a libheif heap buffer overflow, an OpenAI single sign-on misconfiguration, and exploit code written with help from Claude Opus 5 to gain access to an OpenAI employee account and the company’s internal main code repository in under 72 hours. The group said it did not touch sensitive source code and instead opened a harmless pull request to prove access. OpenAI later paid a $6,500 bounty. According to Hacktron’s account, the attack began with an image uploaded to community.openai.com, a Discourse-based forum that processed HEIC and HEIF files through ImageMagick and libheif. The team said it moved from remote code execution in the production forum environment to admin access, then into an employee account whose Codex instance was connected to OpenAI’s GitHub organization. Hacktron argues the more serious issue was not the hosted forum alone, but the SSO setup that linked multiple services under the same login framework. The team also framed the incident as part of a broader shift in offensive capability, saying AI tools sharply increased what a small group could do with limited spending.

500